CVE-2024-53355

Multiple incorrect access control issues in EasyVirt DCScope (versions <= 8.6.0) and EasyVirt CO2Scope (versions

CVE-2024-53354

Multiple SQL injection vulnerabilities exist in EasyVirt DCScope (versions <= 8.6.0) and CO2Scope (versions

CVE-2024-53357

Multiple SQL injection vulnerabilities exist in EasyVirt DCScope versions 8.6.0 and earlier and EasyVirt CO2Scope versions 1.3.0 and earlier. These flaws allow remote authenticated attackers with low privileges to perform unauthorized actions, including adding admin users, modifying/deleting user...

CVE-2024-53356

EasyVirt DCScope (versions 8.6.0 and earlier) and CO2Scope (versions 1.3.0 and earlier) are vulnerable to privilege escalation due to a weak JWT secret . The underlying cause is a hardcoded HMAC secret ("somerandomaccesstoken") used for generating tokens. This flaw allows remote attackers to gene...

CVE-2024-57587

Multiple SQL injection vulnerabilities exist in EasyVirt DCScope (versions 8.6.0 and earlier ) and EasyVirt CO2Scope (versions 1.3.0 and earlier ). These vulnerabilities allow remote unauthenticated attackers to execute arbitrary SQL commands by exploiting the username or password parameters at t...

CVE-2024-55062

A code injection vulnerability exists in EasyVirt DCScope (version 8.6.0 and earlier) and EasyVirt CO2Scope (version 1.3.0 and earlier). This flaw allows remote unauthenticated attackers to execute arbitrary code via the /api/license/sendlicense/ API endpoint. To remediate this, users should upda...